ssh: type/provider for ssh files for Puppet

This module provides a new type/provider for Puppet to read and modify ssh config files using the Augeas configuration library.

The advantage of using Augeas over the default Puppet parsedfile implementations is that Augeas will go to great lengths to preserve file formatting and comments, while also failing safely when needed.

This provider will hide all of the Augeas commands etc., you don't need to know anything about Augeas to make use of it.

Requirements

Ensure both Augeas and ruby-augeas 0.3.0+ bindings are installed and working as normal.

See Puppet/Augeas pre-requisites.

Installing

On Puppet 2.7.14+, the module can be installed easily (documentation):

puppet module install herculesteam/augeasproviders_ssh

You may see an error similar to this on Puppet 2.x (#13858):

Error 400 on SERVER: Puppet::Parser::AST::Resource failed with error ArgumentError: Invalid resource type `sshd_config` at ...

Ensure the module is present in your puppetmaster's own environment (it doesn't have to use it) and that the master has pluginsync enabled. Run the agent on the puppetmaster to cause the custom types to be synced to its local libdir (puppet master --configprint libdir) and then restart the puppetmaster so it loads them.

Compatibility

Puppet versions

Minimum of Puppet 2.7.

Augeas versions

Documentation and examples

Type documentation can be generated with puppet doc -r type or viewed on the Puppet Forge page.

ssh_config provider

manage simple entry

ssh_config { "ForwardAgent":
  ensure => present,
  value  => "yes",
}

manage array entry

ssh_config { "SendEnv":
  ensure => present,
  value  => ["LC_*", "LANG"],
}

manage entry for a specific host

ssh_config { "X11Forwarding":
  ensure    => present,
  host      => "example.net",
  value     => "yes",
}

manage entries with same name for different hosts

ssh_config { "ForwardAgent global":
  ensure => present,
  key    => "ForwardAgent",
  value  => "no",
}

ssh_config { "ForwardAgent on example.net":
  ensure    => present,
  key       => "ForwardAgent",
  host      => "example.net",
  value     => "yes",
}

manage entry with a comment

ssh_config { "ForwardAgent":
  ensure  => present,
  key     => "ForwardAgent",
  value   => "no",
  comment => "Do not forward",
}

delete entry

ssh_config { "HashKnownHosts":
  ensure => absent,
}

ssh_config { "BatchMode":
  ensure    => absent,
  host      => "example.net",
}

manage entry in another ssh_config location

ssh_config { "CheckHostIP":
  ensure => present,
  value  => "yes",
  target => "/etc/ssh/another_sshd_config",
}

sshd_config provider

manage simple entry

sshd_config { "PermitRootLogin":
  ensure => present,
  value  => "yes",
}

manage array entry

sshd_config { "AllowGroups":
  ensure => present,
  value  => ["sshgroups", "admins"],
}

append to array entry

sshd_config { "AllowGroups":
  ensure       => present,
  value        => ["sshgroups", "admins"],
  array_append => true,
}

manage entry in a Match block

sshd_config { "X11Forwarding":
  ensure    => present,
  condition => "Host foo User root",
  value     => "yes",
}

sshd_config { "AllowAgentForwarding":
  ensure    => present,
  condition => "Host *.example.net",
  value     => "yes",
}

manage entries with same name in different blocks

sshd_config { "X11Forwarding global":
  ensure => present,
  key    => "X11Forwarding",
  value  => "no",
}

sshd_config { "X11Forwarding foo":
  ensure    => present,
  key       => "X11Forwarding",
  condition => "User foo",
  value     => "yes",
}

sshd_config { "X11Forwarding root":
  ensure    => present,
  key       => "X11Forwarding",
  condition => "User root",
  value     => "no",
}

manage entry with a comment

sshd_config { "X11Forwarding":
  ensure  => present,
  key     => "X11Forwarding",
  value   => "no",
  comment => "No X11",
}

delete entry

sshd_config { "PermitRootLogin":
  ensure => absent,
}

sshd_config { "AllowAgentForwarding":
  ensure    => absent,
  condition => "Host *.example.net User *",
}

manage entry in another sshd_config location

sshd_config { "PermitRootLogin":
  ensure => present,
  value  => "yes",
  target => "/etc/ssh/another_sshd_config",
}

sshd_config_match provider

manage entry

sshd_config_match { "Host *.example.net":
  ensure => present,
}

manage entry with position

sshd_config_match { "Host *.example.net":
  ensure   => present,
  position => "before first match",
}

sshd_config_match { "User foo":
  ensure   => present,
  position => "after Host *.example.net",
}

manage entry with a comment

sshd_config_match { "Host *.example.net":
  ensure  => present,
  comment => "Example network",
}

delete entry

sshd_config_match { "User foo Host *.example.net":
  ensure => absent,
}

manage entry in another sshd_config location

sshd_config_match { "Host *.example.net":
  ensure => present,
  target => "/etc/ssh/another_sshd_config",
}

sshd_config_subsystem provider

manage entry

sshd_config_subsystem { "sftp":
  ensure  => present,
  command => "/usr/lib/openssh/sftp-server",
}

manage entry with a comment

sshd_config_subsystem { "sftp":
  ensure  => present,
  command => "/usr/lib/openssh/sftp-server",
  comment => "SFTP sub",
}

delete entry

sshd_config_subsystem { "sftp":
  ensure => absent,
}

manage entry in another sshd_config location

sshd_config_subsystem { "sftp":
  ensure  => present,
  command => "/usr/lib/openssh/sftp-server",
  target  => "/etc/ssh/another_sshd_config",
}

sshkey provider

manage entry

sshkey { "foo.example.com":
  ensure  => present,
  type    => "ssh-rsa",
  key     => "AAADEADMEAT",
}

manage entry with aliases

sshkey { "foo.example.com":
  ensure       => present,
  type         => "ssh-rsa",
  key          => "AAADEADMEAT",
  host_aliases => [ 'foo', '192.168.0.1' ],
}

manage hashed entry

sshkey { "foo.example.com":
  ensure        => present,
  type          => "ssh-rsa",
  key           => "AAADEADMEAT",
  hash_hostname => true,
}

hash existing entry

sshkey { "foo.example.com":
  ensure        => hashed,
  type          => "ssh-rsa",
  key           => "AAADEADMEAT",
  hash_hostname => true,
}

delete entry

sshkey { "foo.example.com":
  ensure => absent,
}

manage entry in another ssh_known_hosts location

sshkey { "foo.example.com":
  ensure  => present,
  type    => "ssh-rsa",
  key     => "AAADEADMEAT",
  target  => "/root/.ssh/known_hosts",
}

Issues

Please file any issues or suggestions on GitHub.

Changelog

4.0.0

• Deprecate support for Augeas < 1.0.0
• Update supported Ubuntu versions
• sshd_config: close array regexp (GH #54), fix GH #52
• sshd_config_match: remove duplicated condition param in test (GH #58)
• sshkey: do not test type update, it's a parameter in Puppet 6 (GH #59)
• Add support for comments in types and providers (GH #61)
• Update copyright and authors infos

3.3.0

• Add EL8 support
• Add 'Port' to the list of items supporting Arrays in the documentation

3.2.1

• Fix puppet requirement to < 7.0.0

3.2.0

• add support for Puppet 5 & 6
• deprecate support for Puppet < 5
• update supported OSes in metadata.json

3.1.0

• Add support for array_append to sshd_config type (GH #43)

3.0.0

• Fix support for 'puppet generate types'
• Bumped supported puppet version to less than 6.0.0
• Updated the spec_helper.rb to correctly load for Puppet 5
• Added CentOS and OracleLinux to supported OS list

2.5.3

• ssh_config: fix HostKeyAlgorithms and KexAlgorithms (#GH 36)

2.5.2

• Added docker acceptance test
• Refactor the travis.yml for the current LTS versions of Puppet

2.5.1

• Bugfix Release:
  • Allow multiple values for GlobalKnownHostsFile (#GH 32)
  • Ensure that AddressFamily comes before ListenAddress (#GH 34)

2.5.0

• Implement instances for sshkey (only for non-hashed entries)

2.4.0

• Add sshd_config_match type and provider (#GH 5)
• Purge multiple array entries in ssh_config provider (GH #12)

2.3.0

• Add sshkey provider (GH #13)
• sshd_config: munge condition parameter
• Improve test setup
• Get rid of Gemfile.lock
• Improve README badges

2.2.2

• Properly insert values after commented out entry if case doesn't match (GH #6)

2.2.1

• Convert specs to rspec3 syntax
• Fix metadata.json

2.2.0

• sshd_config: consider KexAlgorithms and Ciphers as array values (GH #4)

2.1.0

• Add ssh_config type & provider

2.0.0

• First release of split module.